Access requests API
Enable programmatic approval, denial, and revocation of access, enabling seamless integration with internal tools, bots, and security workflows for automated access escalation.
The Access Request API enables programmatic approval, denial, and revocation of access requests within the P0 platform. It is designed to support custom workflows and automation. Integrate with external systems and services to process access grants without using the P0 user interface.
This is particularly useful for integrating P0 into your internal tooling, bots, or security workflows that require automatic access escalation based on alerts, CI/CD pipelines, or external approvals.
You can also revoke many access requests in a single call — either every currently-active request for a principal, or an explicit list of request IDs — with the bulk revocation endpoint below. It's restricted to owners and API keys, supports a dryRun preview, and is intended for offboarding and other bulk cleanup workflows.
Approves a pending access request, after which P0 provisions the access. The optional body overrides the grant duration.
The P0 organization slug, the same value that appears in console URLs at p0.app/o/{orgId}.
The ID of the access request, as returned by the Command API when the request was created.
A P0 duration to grant instead of the requested one, for example 30m, 2h, or 1d.
2hSet to true when expirationLength is not one of the organization's preset expiry options.
The request was approved.
SuccessThe caller could not be authenticated.
The caller is not allowed to perform this action on the request, for example the identity is not an approver under the matching access policy.
No access request exists with this ID in this organization.
POST /o/{orgId}/permission-requests/{requestId}/approve HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 47
{
"expirationLength": "2h",
"isCustomExpiry": true
}{
"message": "Success"
}Denies a pending access request. Denial cannot be undone — the requestor must submit a new request.
The P0 organization slug, the same value that appears in console URLs at p0.app/o/{orgId}.
The ID of the access request, as returned by the Command API when the request was created.
The request was denied.
SuccessThe caller could not be authenticated.
The caller is not allowed to perform this action on the request, for example the identity is not an approver under the matching access policy.
No access request exists with this ID in this organization.
POST /o/{orgId}/permission-requests/{requestId}/deny HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"message": "Success"
}Revokes an active grant before it expires. P0 automatically revokes access at expiry, so this is only needed to end a grant early. Revocation cannot be undone — the requestor must submit a new request to restore access.
The P0 organization slug, the same value that appears in console URLs at p0.app/o/{orgId}.
The ID of the access request, as returned by the Command API when the request was created.
The grant was revoked.
SuccessThe caller could not be authenticated.
The caller is not allowed to perform this action on the request, for example the identity is not an approver under the matching access policy.
No access request exists with this ID in this organization.
POST /o/{orgId}/permission-requests/{requestId}/revoke HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"message": "Success"
}Revokes many access requests in one call, either every currently-active request for a principal or an explicit list of request IDs. Unlike the single-request actions above, this endpoint is restricted to owners and API keys (API keys always act as an owner). Each eligible request is revoked individually — a request that is not currently revocable is reported in skipped rather than failing the whole call. Since revocation is asynchronous, this returns 202 Accepted once every request has been submitted, skipped, or found to have failed; it does not wait for deprovisioning to finish. Set dryRun to preview which requests would be affected without revoking anything.
The P0 organization slug, the same value that appears in console URLs at p0.app/o/{orgId}.
{"type":"principal","principal":"jane.doe@example.com"}When true, classify requests without revoking anything.
falseEvery matched request has been submitted for revocation, skipped, or classified as failed. See the response body for the outcome of each one.
IDs of requests that were revoked (or would be, under dryRun).
The request body failed validation, for example more than 1,000 requestIds or a blank principal.
The caller could not be authenticated.
The caller is not allowed to perform this action on the request, for example the identity is not an approver under the matching access policy.
POST /o/{orgId}/permission-requests/revocations HTTP/1.1
Host: api.p0.app
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 81
{
"target": {
"type": "principal",
"principal": "jane.doe@example.com"
},
"dryRun": false
}{
"submitted": [
"text"
],
"skipped": [
{
"requestId": "text",
"reason": "text"
}
],
"failed": [
{
"requestId": "text",
"error": "text"
}
]
}Last updated